framefilter/keyroost v0.8.0

on GitHub

Why 0.8.0 and not 0.7.9: this release changes the published library
crates in ways that require adjustments from code built on them — a new
Instruction variant in keyroost-piv and a new public field on
keyroost-resolve's Device — so the version number says so, per semver.
Nothing else should be read into the jump: there is no 0.7.9, the 0.7
series simply ends here, only the latest release is ever maintained, and
the app itself is unaffected. Exact adjustments for library users are in
the migration notes.

Added

• piv new-chuid (and a matching GUI action): write a fresh CHUID with a
  random GUID to a PIV card. Windows' PIV minidriver caches a card's contents
  keyed by the CHUID's GUID, so re-randomizing it makes Windows re-read a
  reprovisioned card. Encoding matches yubico-piv-tool's template; the GUID
  comes from the OS's secure random source. Contributed by @episource. (#102)
• Nitrokey 3 PIV support. keyroost's PIV surface now works on the
  Nitrokey 3, whose applet omits several Yubico extensions — the differences
  are detected from the card's own responses, never from its make or model.
  Verified end-to-end on a Nitrokey 3A NFC by the contributor, @episource,
  and cross-checked against Nitrokey's published firmware source. (#102)

Changed

• keyroost now says when it couldn't check a capability instead of guessing
  silently. A capability can be verified present (the device answered for
  it), absent, or unverified — offered without device evidence, which
  happens when a key is seen only over USB-HID and no smart-card reader was
  available to ask. Unverified capabilities behave exactly as before (the
  surface is offered and trying it gives the definite answer), but they are
  now rendered honestly: the GUI tab and capability pill gain a quiet "?"
  with an explanation, the CLI overview and list show e.g. OTP?, and the
  --json device output carries the state in a new caps_unverified field.
  This closes the gap behind the #82 → #95 OTP back-and-forth: the old
  present/absent-only model had to write "could not check" down as one or the
  other, giving a guess an authority it should never have had. (#95)

• piv generate-key --pin-policy / --touch-policy now explain
  themselves. The flags have chosen the key-generation PIN/touch policy
  since PIV management landed, but --help never said what the values mean.
  It now spells out that default sends the standard PIV command every card
  accepts, and that the other values are a Yubico extension
  (firmware-dependent). Settles the CLI half of the #97 review follow-ups —
  the GUI/CLI parity itself turned out to already exist. (#97)

Fixed

• PIV commands with large payloads now work on cards that only speak
  short APDUs. Signing and certificate import used extended-length APDUs
  unconditionally; cards that reject those (the Token2 PIN+ contact
  interface among them) now get the same bytes as a chained sequence of
  short commands instead. Cards that accept extended-length see identical
  traffic to before, pinned by tests. Contributed by @episource. (#101)
• The app now says which version it is. The GUI shows a small version
  next to the wordmark in the top bar, and the AppImage embeds its version in
  the bundle metadata (X-AppImage-Version) so AppImage managers such as
  Gear Lever can display it. Previously the version was visible nowhere —
  not in the app, not in the AppImage. Reported by @alphazo. (#98)

Full changelog: https://github.com/framefilter/keyroost/blob/v0.8.0/CHANGELOG.md